CVE-2026-15240

Name of the Vulnerable Software and Affected Versions Customer Switching for WooCommerce versions prior to 2.1.3

Description The plugin fails to securely bind an active user-switching session to the operator who initiated it. This allows an authenticated attacker with customer-level access or higher to be resolved as the operator and switch into any permitted account, including those with administrator privileges, leading to full account takeover.

Recommendations Update to version 2.1.3 or later.